EP1657847A1 - Method, device and system for generating anonymous public keys - Google Patents
Method, device and system for generating anonymous public keys Download PDFInfo
- Publication number
- EP1657847A1 EP1657847A1 EP20050023986 EP05023986A EP1657847A1 EP 1657847 A1 EP1657847 A1 EP 1657847A1 EP 20050023986 EP20050023986 EP 20050023986 EP 05023986 A EP05023986 A EP 05023986A EP 1657847 A1 EP1657847 A1 EP 1657847A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- group
- generator
- private key
- key
- public keys
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3006—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters
- H04L9/3013—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy underlying computational problems or public-key parameters involving the discrete logarithm problem, e.g. ElGamal or Diffie-Hellman systems
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/42—Anonymization, e.g. involving pseudonyms
Definitions
- This invention relates to computer communication network security, and more particularly to public key cryptographic communication systems and methods.
- An example for protecting the information's security is the secure e-mail system. In this case, only the sender and the receiver can interpret the e-mail.
- Another example is the secure electronic payment system, where only the owner of an account can spend the funds in the account.
- the participants of e-mail and electronic payment systems expect that nobody else other than the participants knows the existence of communication.
- To protect the sender's privacy in an email it may be necessary in some cases that even the receiver cannot tell who the sender is.
- For an electronic payment transaction it may sometimes be preferable that the payee cannot identify the payer.
- location based services the location of the owner who carries a mobile device is in most cases under full control of the owner.
- the payer may want to inhibit the online merchants from correlating her purchasing history, and then deducing her personal interest.
- the bidder may want to prevent competitors from analyzing her bidding strategy, and then using such knowledge to defeat her.
- Other examples include anonymous membership management and anonymous voter for e-voting etc.
- cryptographic communication systems are adapted to transfer a message between remote locations.
- Such systems include at least one encoding device at a first location and at least one decoding device at a second location, with the encoding and decoding devices both being coupled to computer communication networks.
- the message is defined to be a digital message, that is, a sequence of symbols from some alphabet.
- the alphabet is generally chosen to be the binary alphabet consisting of the symbols 0 and 1.
- each user's terminal is often equipped with both an encoder and a decoder so that the user can transmit and receive encrypted information to and from another user.
- each user places in a public file an enciphering operator or public key, E A .
- E A and D A must be efficiently computable.
- user A must not compromise D A when revealing E A . That is, it should not be computationally feasible for an adversary to find an efficient way of computing D A , given only the enciphering key E A and probably some sorts of plain text-cipher text pairs.
- a judicious selection of keys ensures that only user A is able to compute D A efficiently.
- Said procedure of secure communication implies that each user who wishes to receive private communication must place his enciphering key E in the public file.
- traditional public key cryptosystem such as RSA and El Gamal
- user A is required to disclose his/her public key to outer world.
- user A only possesses one public/private key pairs, i.e. one public key and its corresponding unique private key. This typical kind usage of public key cryptosystem has the unintentional consequence of making user A's public key properly serve as his/her identity.
- Waters et al. have proposed a method making use of E1 Gamal cryptosystem to realize an Incomparable Public keys Scheme, by which a user can simultaneously possess several public keys while all these public keys correspond to a single private key. See B. R. Waters, E. W. Felten, A. Sahai, Receiver Anonymity via Incomparable Public keys, CCS'03, Washington, DC, USA, pp.112 ⁇ 121. (hereinafter "Waters"). The teaching of Waters is also incorporated by reference.
- each distinct public key has a corresponding distinct private key which implies that along with the increasing number of public keys, the managing cost of public-private key pairs for individual increases.
- each distinct public key has a corresponding distinct private key which implies that along with the increasing number of private keys, the security risk of loss or disclosure of private keys increases.
- a person possessing 100 public key pairs which are definitely quite a lot for a person with traditional public key cryptosystems. Suppose the person intends to communicate with 200 correspondents either in parallel or serial communications.
- Waters ' scheme seems to be able to eliminate the managing cost of several public key pairs as well as concomitant security risks.
- their Incomparable Public Keys Scheme generates new public keys by utilizing different generators to construct the public key of the El Gamal cryptosystem, which makes computation optimization difficult.
- (g, g a ) and (h, h a ) are different public keys generated by Waters' Incomparable Public Keys Scheme, where g and h are different generators.
- the E1 Gamal cryptosystem makes use of only one generator hence it can be benefited by calculating the power of generator off-line and maintaining only one table of the power of generator.
- Waters' scheme requires either maintaining several tables of the power of different generators, or on-line computation, neither of which is very desirable in terms of computation optimization and cost management.
- This invention discloses public key cryptosystems for generating a plurality of anonymous public keys all of which relate to the same party used for secure communications. Furthermore, those anonymous public keys are generated using the same generator from one single private key.
- this invention is based on the application and implementation of the well-known Group Theory in mathematics.
- G be a finite cyclic group.
- the decoding key (private key) D is a selected member x of group G.
- g be a generator of group G.
- the mapping methods may vary for different groups as defined by the selected groups.
- C 1 or C 2 is originally outside the range of group G, they must be mapped into group G.
- the mapping methods may vary for different groups or for different implementation, and they are well known to those skilled in the art.
- an indicator r Through the selection of an indicator r, the user can generate lots of public keys corresponding to a single private key x.
- the user needs to maintain only one table for storing the powers of the generator and can compute them off-line, thus avoiding overhead for on-line computation.
- this invention discloses a novel anonymous pubic keys technique for a secure communication system.
- the present invention utilizes powers, i.e. exponentiation, of the generator to construct anonymous public keys, while El Gamal Cryptosystem and Waters' scheme directly use the generator to construct public key.
- this invention enables privacy-concerned people to disclose his/her public keys to the correspondent in order to set up secure communications where communication histories are significant.
- this invention is based on a new technique where multiple public keys correspond to a single private key, hence greatly reducing individual managing cost of public key pairs and lowering the security risk on private key to the max extent.
- this invention allows for new optimization techniques that can facilitate adopting proposed anonymous public keys at lower cost and shift computation-intensive tasks to offline or off-peak time of computing system.
- this invention can reduce the inevitable computation overhead by effectively and efficiently shifting part of the computation burden to correspondent, without notably introducing additional cost to the correspondent.
- this invention allows for a new optimization technique which can efficiently reduce the storage consumption of the public keys.
- this invention naturally guarantees the anonymity of private keys.
- the private key is inevitably identified by the unique public key, although the exact value of the private key is a secret. This leads to a possible utilization of this invention in some cases, where the user may possess some private keys and generate a series of anonymous public keys for different private keys, respectively. In this sense, the private keys in use are anonymized, or in other words, they are anonymous private keys.
- Fig. 1 shows an exemplary system with two terminals utilizing anonymous public keys cryptosystem according to this invention, wherein one of the terminals may reveal a different public key for a new communication session with the other terminal;
- Fig. 2 shows an exemplary system with several terminals utilizing anonymous public keys cryptosystem according to this invention, wherein one terminal may communicate with the other terminals with different public keys used for different communications;
- Fig. 3 shows an exemplary communication session between the Sender and the Receiver participating in the communication system illustrated in Fig.1 and Fig.2;
- Fig. 4 shows the exemplary functional blocks of the Sender and Receiver in a communication session based on public-private key pairs in accordance with the present invention
- Fig. 5 shows the exemplary functional blocks of the Public Keys Generating Device in Fig.4 in accordance with the present invention
- Fig. 6 shows an exemplary process flow of generating anonymous public keys according to the present invention.
- Fig. 7 shows the exemplary procedures of encryption and decryption of a message.
- the set of integers Z with operation of addition forms a group.
- the identity element is 0 and the inverse of an integer a is the integer -a.
- Handbook of Applied Cryptography available online at http://www.cacr.math. uwaterloo.ca/hac/.
- Fig.1 shows one embodiment of this invention in simplified block diagram.
- Terminal A is communicating with Terminal a for several sessions.
- the sessions may use one or several communication channels.
- Terminal a may or may not use the same communication channel to send information to Terminal A.
- Terminal A reveals different public keys E a to E z to Terminal a for different communication sessions, but keeps its private key x secret.
- Terminal a is equivalent to Terminal A in terms of revealing several different public keys to Terminal A if Terminal a needs to do so.
- Fig. 2 also shows another embodiment of this invention in simplified block diagram.
- Terminal A is communicating with multiple terminals, from Terminal a to Terminal z.
- the communication channels in use between Terminal A and each of its correspondents may or may not be the same.
- Terminal A reveals different public keys E a to E z , among other things, to Terminal a, Terminal b,...Terminal z, respectively.
- E a to E z among other things, to Terminal a, Terminal b,...Terminal z, respectively.
- Said revelation can be accomplished in various ways. For example, there may be other information that is also revealed together with the public keys, or the public keys may be incorporated in an email or certificate.
- Terminal a to Terminal z may or may not use the same communication channel, over which each of them receives a public key of Terminal A, to send information, which is encrypted with the public keys that have been received, to Terminal A.
- Terminal A keeps its private key x secret.
- Terminal a to Terminal z are equivalent to Terminal A in terms of revealing several different public keys to Terminal A if Terminal a to Terminal z need to do so, respectively.
- Terminal a to z reveals their respective own public keys E a to E z to Terminal A. In this case, we assume there exists a "many-to-one" relationship between Terminal a to z and Terminal A.
- Fig. 3 shows an exemplary communication session between the Sender and the Receiver participating in the communication system illustrated in Fig. 1 and Fig. 2.
- the Sender decides (step S31) to either select one from its pool of existing public keys (step S32) or generate a new public key (step S33). Then the Sender sends the public key to the Receiver (step S34).
- the Receiver finds the Sender's public key (step S36) to encrypt the message (step S37) and then sends the encrypted message to the Sender.
- the Sender decrypts the received encrypted message (step S38) and recovers the original message sent from the Receiver.
- the Receiver may have received the public key from the Sender long ago before it wants to send encrypted message to the Sender.
- Step S33 the Sender may be designed in such a way that it always generates a different public key (Step S33), without relying on any existing keys.
- the use of an existing pool of public keys will significantly reduce the computation overhead, since manipulation of the existing keys is inherently less computation-intensive than computing from scratch.
- the Sender and Receiver in Fig. 3 are only designated this way for convenience sake, since the Sender is the first to send its public key to the Receiver. Once the Receiver has the public key from the Sender, the Receiver actually becomes a sender when it sends the encrypted message to its receiver, the Sender. In a typical bilateral communication session between two terminals, the roles are frequently reversed throughout the session.
- Fig. 4 shows the exemplary functional blocks of the Sender and Receiver in a communication session based on public-private key pairs in accordance with the present invention.
- the Sender 41 comprises, at least, a Sending Unit 43 and Receiving Unit 45 which deal with the communication channel, a Decoding Device 47 which handles decryption of cipher texts, and a Public Keys Generating Device 49 which handles public keys generating.
- the Receiver 42 comprises, at least, a Sending Unit 44, a Receiving Unit 46 and an Encoding Device 48 for handling encryption of information to be transmitted such as plain texts.
- the Sender 41 may disclose multiple public-keys to the Receiver 42, such that if there are multiple sessions between the Sender 41 and the Receiver 42, each session may use a different public key of the Sender 41.
- the Sender 41 also acts as a receiver, it may further comprise an Encoding Device 48.
- the Receiver 42 acts as a sender, it may further comprise a Decoding Device 47 and a Public Keys Generating Device 49.
- the Encoding Device 48 and the Decoding Device 47 in Fig. 4 are both well known in the field of data communication and encryption.
- the Public Keys Generating Device 49 is further elaborated in Fig. 5 below.
- the Control Unit 55 handles the process of generating public keys as well as the duty of managing the keys.
- the Register 54 may be utilized to store the private key, pubic keys generated, public keys received and other data required by the Control Unit 55.
- the Register 54 used herein can be implemented by any device that can store information, such as on-chip registers, ROM, and RAM.
- the Pubic Keys Generating Device 49 may share the Register 54 with the Decoding Device 47 to store cipher texts received and intermediate output in the decryption. Other components of the Public Keys Generating Device 49 will be described later.
- Fig. 6 shows the exemplary process flow for generating APK/private key pairs.
- a group G is selected by the Group Selector 51 (Step S60).
- a computer may have memory in which various data structures representing various eligible groups are stored. Under the control of the Control Unit 55, the Group Selector 51 selects one group by selecting the data structure representing the group.
- An application program that intends to implement the present invention may call, with some specific parameters, a particular function provided by such libraries. And then the called function can return the desired group(s).
- G is a finite cyclic group and its order is n, which is a positive integer.
- Candidates of the finite cyclic group G include but is not limited to:
- the first group may have the best security performance, while the latter three are more commonly used in the art.
- the "finite cyclic" nature of group G guarantees that the result of group exponentiation operation will eventually be mapped into group G; however the mapping methods may vary from group to group. Besides, it also guarantees the existence of a generator.
- the Integer Selector 56 selects an integer as the private key x, such that x satisfies 1 ⁇
- the Generator Selector 53 selects and fixes a generator g of group G (Step S63). If G is a finite cyclic group, it always has at least one generator. It is to be noted that the selections of g and x is independent from each other. That is to say, although Step S62 is described prior to Step S63 here, the order of their performance can be reversed or they can be performed in parallel.
- Step S64 After the selection of G, m, x and g, an integer r is selected as the indicator that satisfies 0 ⁇
- Steps S62, S63, S64 can be performed in any order, sequentially or concurrently.
- the selection of g, x and r may be at random or in accordance with some criteria as desired.
- the Control Unit 55 may skip some of the aforementioned procedures, but performed elsewhere.
- the group G and the subgroup can be assigned by a third party such as an entrust organization.
- the Control Unit 55 skips steps of selecting the group and subgroup, since they are now determined externally.
- one anonymous public key has been previously generated, it is for certain that the group, subgroup, generator and private key all have been selected and fixed. Therefore when a new public key is to be generated, the Control Unit 55 skips these four steps and goes directly to the following steps.
- mapping methods may vary for different groups. However, the cyclic group G guarantees the existence of such mapping method.
- Fig. 6 The exemplary method primarily described in Fig. 6 is only one of the numerous methods available for generating anonymous public keys according to the present invention. There are more advanced methods that not only can be used for the same purpose, but also can achieve optimization in performance. To describe the optimization methods, the encoding and decoding procedures well known in the art are briefly summarized with reference to Fig. 4, 5 and 7, wherein ⁇ is a group G invertible operation and ⁇ is the exact inverse operation of ⁇ . The present invention has been applied in the procedures in Fig.7.
- M is first represented as an element of G (for example, M is represented as its ASCII code) (Step S80), then an integer k is selected as the designator satisfying 1 ⁇
- a message M that is outside the range of group G to be encoded it must be transformed into several group members before encoding. Following subsequent decoding, the recovered group members may be transformed back to the original message.
- the transformation methods may vary for different groups.
- One example is breaking the message into several blocks, each of which is a member of group G, and concatenating all the blocks to reconstruct M.
- the cipher-text message C is received (Step S84).
- the Public Keys Generating Device 49 may generate a new anonymous public key in the form of (y 2 , y 2 x ). This method can be utilized multiple times to generate a chain of public keys. This way, storage consumption of the public keys generated are heavily reduced since the second portion of the public key, y 2 , is identical to the first portion of its following. For a chain of w public keys, up to (w-1)/2w percentage of storage are saved which implies approximate 50% saving for w large enough.
- the powers of the generator g can be reused to generate a series of public keys, which involves multiplication, instead of exponentiation, thus saving the memory storage and accelerating the computation. Meanwhile; since only one table of the powers of the generator needs to be maintained in the decoding device, the computation of new public keys can be performed off-line.
- g rk can be saved to generate new public keys because the product "rk" is only another integer. It is to be noted that although g rk can be saved to generate new public keys, the value of rk may still be unknown to the decoding device, unless the encoding device revealed k when sending the encrypted message.
- the Public Keys Generating Device 49 may generate a new anonymous public key in the form of (y 1 ⁇ y 1 , y 2 ⁇ y 2 ), where ⁇ is group multiplication.
- ⁇ group multiplication.
- the exponentiation operation is replaced by multiplication and computation efficiency is enhanced. Since multiplication can be carried out online, new public keys generated in this way may not need to be pre-computed, which directly implies saving of storage space.
- the decoding device can generate more new public keys. For this purpose, C 1 x and C 1 -x can be computed and saved, and then two series of public keys can be generated.
- C 1 x and C 1 -x can be computed and saved, and then two series of public keys can be generated.
- the user may wish to select several private keys and generate several series of anonymous public keys for different private keys, respectively.
- the user can select several private keys x i , and generate anonymous public keys for each x i as (g a , g axi ). Since the one-private-key-to-one-public-key model is displaced by the teaching of the present invention, the anonymity of anonymous public keys implies anonymity of said several private keys. In this sense, this invention also achieves anonymous private key.
- Receiver A that receives public key (5, 4) has plain text 8 to encrypt.
- Receiver B has plaintext 10 to encrypt.
- the cipher text (5, 10) and (2, 3) are passed to the decoding side, respectively.
- plaintext 8 and 10 are successfully retrieved at the decoding side. Further, optimization techniques can be utilized to generate new anonymous public keys.
- an anonymous public key may be generated as (2, 8).
- aspects of the invention can be implemented in computer executable instructions contained in computer readable medium, and it can also be implemented in hard-wired logic/circuitry or combination of hardware and software.
- the devices involved in the specification may also include memory, such as RAM, DRAM and ROM, to store necessary data and computer executable instructions to perform the steps taught in this invention.
- memory can also be incorporated in the encoding device and/or the decoding device of the terminal. Such use of the memory is well known in the art, so it is not described here or illustrated in the accompanying drawings.
Landscapes
- Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Storage Device Security (AREA)
- Computer And Data Communications (AREA)
- Mobile Radio Communication Systems (AREA)
- Telephonic Communication Services (AREA)
Abstract
One embodiment of the invention is based on the El Gamal Cryptosystem.
Description
- This invention relates to computer communication network security, and more particularly to public key cryptographic communication systems and methods.
- With the proliferation of computer communication networks, such as IP network, telecommunication network, mobile ad-hoc network, and personal area network, many applications have been developed and deployed over said computer communication networks. These applications include healthcare system, e-prescription system, e-mail system, e-shopping system, e-auction system, multimedia system, pay-TV system, location based service system, and ubiquitous computing system etc. However, information, or more generically data, transferred through these systems is subject to hacking, snooping, eavesdropping, tampering, and manipulation and so on. While the degree of concern for security and privacy may vary from application to application and notably from person to person, it's a general requirement that digital information be securely delivered from the sender to the receiver, and that neither a third-party nor the receiver can jeopardize the information's security. In addition, it is required that the privacy of the sender, as well as the receiver, be preserved to a satisfactory extent.
- An example for protecting the information's security is the secure e-mail system. In this case, only the sender and the receiver can interpret the e-mail. Another example is the secure electronic payment system, where only the owner of an account can spend the funds in the account.
- Information privacy issues in many cases demand equal, if not heightened, awareness as information security issues. Consider the aforementioned secure e-mail and secure electronic payment systems, wherein the participants of e-mail and electronic payment systems expect that nobody else other than the participants knows the existence of communication. To protect the sender's privacy in an email, it may be necessary in some cases that even the receiver cannot tell who the sender is. For an electronic payment transaction, it may sometimes be preferable that the payee cannot identify the payer. There are many other examples for information privacy. When utilizing location based services, the location of the owner who carries a mobile device is in most cases under full control of the owner. In e-shopping, the payer may want to inhibit the online merchants from correlating her purchasing history, and then deducing her personal interest. In e-auction, the bidder may want to prevent competitors from analyzing her bidding strategy, and then using such knowledge to defeat her. Other examples include anonymous membership management and anonymous voter for e-voting etc.
- In general, cryptographic communication systems are adapted to transfer a message between remote locations. Such systems include at least one encoding device at a first location and at least one decoding device at a second location, with the encoding and decoding devices both being coupled to computer communication networks. For digital systems, the message is defined to be a digital message, that is, a sequence of symbols from some alphabet. In practice, the alphabet is generally chosen to be the binary alphabet consisting of the
symbols - Conventionally, a number of public key cryptographic encoding and decoding techniques are readily available to provide some degree of security as well as privacy. For example, US Patent No. 4,405,829, issued to Rivest, et al., and E1 Gamal (Tahir ElGamal. A public-key cryptosystem and a signature scheme based on discrete logarithms. Advances in Cryptology Proceedings of CRYPTO 84, pages 10-18, 1985) are technologies well recognized in the field. The teaching of the Rivest patent and E1 Gamal is incorporated by reference.
- In a public key cryptosystem, each user (e.g. user A) places in a public file an enciphering operator or public key, EA. User A keeps to himself the details of the corresponding deciphering operator or private key DA which satisfies the equation
- Whenever another user (e.g. user B) wishes to send a message M to user A, he looks up EA in the public file and then sends the enciphered message EA (M) to user A. Upon receipt, user A deciphers the message by computing
- In the information age, privacy is broadly recognized as a dominant concern of information exchange. Privacy surveys show consistently that 80 to 90 percent of all people are concerned about privacy, and that 25 percent are willing to pay a considerable price in money or inconvenience for it. Such privacy protection significance not only exposes the shortcoming of the existing public key cryptosystem, but also emphasizes the importance and urgency of a new and improved anonymous public key methodology.
- Within traditional public key cryptosystems, such as those disclosed by RSA and El Gamal, if user A is concerned that his/her single public key may violate his/her privacy, it's possible to eliminate the identifiable characteristics of the individual public key. The resort is no more than mandating concerned individual, say user A, to possess several distinct public keys and release each of the public keys to different correspondents with caution.
- Besides possessing many public key pairs, Waters et al. have proposed a method making use of E1 Gamal cryptosystem to realize an Incomparable Public keys Scheme, by which a user can simultaneously possess several public keys while all these public keys correspond to a single private key. See B. R. Waters, E. W. Felten, A. Sahai, Receiver Anonymity via Incomparable Public keys, CCS'03, Washington, DC, USA, pp.112~121. (hereinafter "Waters"). The teaching of Waters is also incorporated by reference.
- By employing multiple public key pairs, conventional public key cryptosystems can mitigate the privacy concern to some extent. However, the concerned individual is still far from being satisfied. In fact, such measure has lots of drawbacks. For one, each distinct public key has a corresponding distinct private key which implies that along with the increasing number of public keys, the managing cost of public-private key pairs for individual increases. For two, each distinct public key has a corresponding distinct private key which implies that along with the increasing number of private keys, the security risk of loss or disclosure of private keys increases. For three, consider a person possessing 100 public key pairs which are definitely quite a lot for a person with traditional public key cryptosystems. Suppose the person intends to communicate with 200 correspondents either in parallel or serial communications. Consequently, at least every 2 out of the correspondents will sense the same public key of the privacy-concerned person, which is definitely considered as unacceptable privacy invasion. Finally, the receiver of a ciphered message may have to try all the private keys to decipher the message, which is very time consuming and inefficient.
- Waters' scheme seems to be able to eliminate the managing cost of several public key pairs as well as concomitant security risks. However their Incomparable Public Keys Scheme generates new public keys by utilizing different generators to construct the public key of the El Gamal cryptosystem, which makes computation optimization difficult. For example, (g, ga) and (h, ha) are different public keys generated by Waters' Incomparable Public Keys Scheme, where g and h are different generators. Conventionally, the E1 Gamal cryptosystem makes use of only one generator hence it can be benefited by calculating the power of generator off-line and maintaining only one table of the power of generator. Waters' scheme requires either maintaining several tables of the power of different generators, or on-line computation, neither of which is very desirable in terms of computation optimization and cost management.
- This invention discloses public key cryptosystems for generating a plurality of anonymous public keys all of which relate to the same party used for secure communications. Furthermore, those anonymous public keys are generated using the same generator from one single private key.
- More particularly, the present invention discloses methods and devices for generating a plurality of public keys from a private key x, based on the same generator g, that assumes the form of (y1=gr, y2=y1 x), where a new public key is generated when a different r is selected, as in the case of a different communication session, or a different correspondent.
- More particularly, this invention is based on the application and implementation of the well-known Group Theory in mathematics. Let G be a finite cyclic group. The decoding key (private key) D is a selected member x of group G. Let g be a generator of group G. Thus, the encoding key (public key) E consists of a pair of group G members, y1 and y2, computed as follows:
- Furthermore, when a different r, the indicator, is selected, a new public key is generated.
-
-
- For a message to be encoded that is outside the range of group G, it must be transformed into several group members before encoding. Following subsequent decoding, the recovered group members may be transformed back to the original message. The transformation methods may vary for different groups or for different implementations.
- If C1 or C2 is originally outside the range of group G, they must be mapped into group G. The mapping methods may vary for different groups or for different implementation, and they are well known to those skilled in the art.
- Through the selection of an indicator r, the user can generate lots of public keys corresponding to a single private key x.
- Accordingly, the user needs to maintain only one table for storing the powers of the generator and can compute them off-line, thus avoiding overhead for on-line computation.
- In contrast to the secure communication system based on Waters' proposal, this invention discloses a novel anonymous pubic keys technique for a secure communication system. The present invention utilizes powers, i.e. exponentiation, of the generator to construct anonymous public keys, while El Gamal Cryptosystem and Waters' scheme directly use the generator to construct public key.
- According to the present invention, there exist at least the following advantages over the conventional techniques:
- One, this invention enables privacy-concerned people to disclose his/her public keys to the correspondent in order to set up secure communications where communication histories are significant.
- Two, this invention is based on a new technique where multiple public keys correspond to a single private key, hence greatly reducing individual managing cost of public key pairs and lowering the security risk on private key to the max extent.
- Three, this invention allows for new optimization techniques that can facilitate adopting proposed anonymous public keys at lower cost and shift computation-intensive tasks to offline or off-peak time of computing system.
- Four, this invention can reduce the inevitable computation overhead by effectively and efficiently shifting part of the computation burden to correspondent, without notably introducing additional cost to the correspondent.
- Five, this invention allows for a new optimization technique which can efficiently reduce the storage consumption of the public keys.
- Six, through anonymizing public keys, this invention naturally guarantees the anonymity of private keys. In contrast, with the conventional public key cryptographic techniques, the private key is inevitably identified by the unique public key, although the exact value of the private key is a secret. This leads to a possible utilization of this invention in some cases, where the user may possess some private keys and generate a series of anonymous public keys for different private keys, respectively. In this sense, the private keys in use are anonymized, or in other words, they are anonymous private keys.
- The foregoing and other objects of this invention, the various features thereof, as well as the invention itself, may be more fully understood from the following description, when read together with the accompanying drawings in which:
- Fig. 1 shows an exemplary system with two terminals utilizing anonymous public keys cryptosystem according to this invention, wherein one of the terminals may reveal a different public key for a new communication session with the other terminal;
- Fig. 2 shows an exemplary system with several terminals utilizing anonymous public keys cryptosystem according to this invention, wherein one terminal may communicate with the other terminals with different public keys used for different communications;
- Fig. 3 shows an exemplary communication session between the Sender and the Receiver participating in the communication system illustrated in Fig.1 and Fig.2;
- Fig. 4 shows the exemplary functional blocks of the Sender and Receiver in a communication session based on public-private key pairs in accordance with the present invention;
- Fig. 5 shows the exemplary functional blocks of the Public Keys Generating Device in Fig.4 in accordance with the present invention;
- Fig. 6 shows an exemplary process flow of generating anonymous public keys according to the present invention; and
- Fig. 7 shows the exemplary procedures of encryption and decryption of a message.
- Methods, devices and systems for generating anonymous public keys in a secure communication system are disclosed. In the following detailed description, numerous specific details are set forth to provide a full understanding of the present invention. It will be obvious, however, to one ordinarily skilled in the art that the present invention may be practiced without some of these specific details. In other instances, well-known structures and techniques have not been shown in detail so as to avoid unnecessarily obscuring the present invention.
- Throughout the specification, the term "group" refers to the mathematics concept defined as follows unless otherwise indicated:
- A group (G, ◇) consists of a set G with a binary operation ◇ on G satisfying the following three axioms:
- (i) The group operation is associative. That is, a◇(b◇c) = (a◇b) ◇c for all elements a, b, c of G;
- (ii) There is an identity element e of G such that a◇e = e◇a = a for all elements a of G; and
- (iii) For each element a of G there exists an element a-1 of G, called the inverse of a, such that a◇a-1 = a-1◇a = e.
- For example, the set of integers Z with operation of addition forms a group. The identity element is 0 and the inverse of an integer a is the integer -a. For more information, please refer to Handbook of Applied Cryptography, available online at http://www.cacr.math. uwaterloo.ca/hac/.
- Communication systems in accordance with this invention may have several terminals and several communication channels. Fig.1 shows one embodiment of this invention in simplified block diagram. In Fig. 1, Terminal A is communicating with Terminal a for several sessions. There is at least one communication channel for Terminal A to send information to Terminal a. The sessions may use one or several communication channels. Terminal a may or may not use the same communication channel to send information to Terminal A. Over the communication channels, Terminal A reveals different public keys Ea to Ez to Terminal a for different communication sessions, but keeps its private key x secret. Terminal a is equivalent to Terminal A in terms of revealing several different public keys to Terminal A if Terminal a needs to do so.
- As can be seen in Fig. 1, by generating different public keys for different sessions, it would be virtually impossible for Terminal a, or any third party, to be able to correlate Terminal A's pattern of activities. For example, in an e-auction setting, the user from Terminal A would be able to prevent others from correlating and analyzing its bidding pattern and strategy, since a different public key is generated for each session.
- Fig. 2 also shows another embodiment of this invention in simplified block diagram. In Fig. 2, Terminal A is communicating with multiple terminals, from Terminal a to Terminal z. The communication channels in use between Terminal A and each of its correspondents may or may not be the same. As shown in the left half of Fig. 2, over the communication channels, Terminal A reveals different public keys Ea to Ez, among other things, to Terminal a, Terminal b,...Terminal z, respectively. In this case, we assume there exists a "one-to-many" relationship between Terminal A and Terminal a to z. Said revelation can be accomplished in various ways. For example, there may be other information that is also revealed together with the public keys, or the public keys may be incorporated in an email or certificate. In return, Terminal a to Terminal z may or may not use the same communication channel, over which each of them receives a public key of Terminal A, to send information, which is encrypted with the public keys that have been received, to Terminal A. As before, Terminal A keeps its private key x secret. Similarly, Terminal a to Terminal z are equivalent to Terminal A in terms of revealing several different public keys to Terminal A if Terminal a to Terminal z need to do so, respectively. Similarly, from the right half of Fig. 2, Terminal a to z reveals their respective own public keys Ea to Ez to Terminal A. In this case, we assume there exists a "many-to-one" relationship between Terminal a to z and Terminal A.
- Fig. 3 shows an exemplary communication session between the Sender and the Receiver participating in the communication system illustrated in Fig. 1 and Fig. 2. In Fig. 3, each time the Sender would like to disclose a public key to the Receiver, the Sender decides (step S31) to either select one from its pool of existing public keys (step S32) or generate a new public key (step S33). Then the Sender sends the public key to the Receiver (step S34). Whenever there is message to send (step S35), the Receiver finds the Sender's public key (step S36) to encrypt the message (step S37) and then sends the encrypted message to the Sender. Finally, the Sender decrypts the received encrypted message (step S38) and recovers the original message sent from the Receiver. Note that the Receiver may have received the public key from the Sender long ago before it wants to send encrypted message to the Sender.
- It should be pointed out that the Sender may be designed in such a way that it always generates a different public key (Step S33), without relying on any existing keys. However, as can be appreciated by those skilled in the art, the use of an existing pool of public keys will significantly reduce the computation overhead, since manipulation of the existing keys is inherently less computation-intensive than computing from scratch.
- It should also be pointed out that the Sender and Receiver in Fig. 3 are only designated this way for convenience sake, since the Sender is the first to send its public key to the Receiver. Once the Receiver has the public key from the Sender, the Receiver actually becomes a sender when it sends the encrypted message to its receiver, the Sender. In a typical bilateral communication session between two terminals, the roles are frequently reversed throughout the session.
- Now reference is turned to Fig. 4, which shows the exemplary functional blocks of the Sender and Receiver in a communication session based on public-private key pairs in accordance with the present invention. Here, the
Sender 41 comprises, at least, a SendingUnit 43 andReceiving Unit 45 which deal with the communication channel, aDecoding Device 47 which handles decryption of cipher texts, and a PublicKeys Generating Device 49 which handles public keys generating. TheReceiver 42 comprises, at least, a SendingUnit 44, aReceiving Unit 46 and anEncoding Device 48 for handling encryption of information to be transmitted such as plain texts. TheSender 41 may disclose multiple public-keys to theReceiver 42, such that if there are multiple sessions between theSender 41 and theReceiver 42, each session may use a different public key of theSender 41. In case theSender 41 also acts as a receiver, it may further comprise anEncoding Device 48. Similarly, and in case theReceiver 42 acts as a sender, it may further comprise aDecoding Device 47 and a PublicKeys Generating Device 49. - The
Encoding Device 48 and theDecoding Device 47 in Fig. 4 are both well known in the field of data communication and encryption. The PublicKeys Generating Device 49 is further elaborated in Fig. 5 below. Referring to Fig. 5, theControl Unit 55 handles the process of generating public keys as well as the duty of managing the keys. TheRegister 54 may be utilized to store the private key, pubic keys generated, public keys received and other data required by theControl Unit 55. In addition, theRegister 54 used herein can be implemented by any device that can store information, such as on-chip registers, ROM, and RAM. The PubicKeys Generating Device 49 may share theRegister 54 with theDecoding Device 47 to store cipher texts received and intermediate output in the decryption. Other components of the PublicKeys Generating Device 49 will be described later. - Note that in Fig. 5, the "group" operation is handled by the
Group Exponentiation Operator 57. There may have other embodiments of the PublicKeys Generating Device 49 where the group operation is handled by a separate Group Operator. - Next, description will be made to the process of the Public
Keys Generating Device 49 of Fig. 4 and Fig. 5 for generating anonymous public keys ("APK") according to the present invention. - Fig. 6 shows the exemplary process flow for generating APK/private key pairs. First, a group G is selected by the Group Selector 51 (Step S60). For example, a computer may have memory in which various data structures representing various eligible groups are stored. Under the control of the
Control Unit 55, theGroup Selector 51 selects one group by selecting the data structure representing the group. In actual practice, there are already some commercial function libraries that can run on the computer and provide such services. An application program that intends to implement the present invention may call, with some specific parameters, a particular function provided by such libraries. And then the called function can return the desired group(s). In one embodiment, G is a finite cyclic group and its order is n, which is a positive integer. Candidates of the finite cyclic group G include but is not limited to: - a group of points on an elliptic curve over a finite field Fq1;
- a multiplicative group Fq2* of a finite field Fq2, where q2=p ml , ml is a positive integer and p is a prime;
- the group of Zn1*, where nl is a composite integer; and
- a multiplicative group of Zn2*, where n2 is a prime.
- Among the above four exemplary kinds of groups, the first group may have the best security performance, while the latter three are more commonly used in the art. The "finite cyclic" nature of group G guarantees that the result of group exponentiation operation will eventually be mapped into group G; however the mapping methods may vary from group to group. Besides, it also guarantees the existence of a generator.
- Then, the
Subgroup Selector 52 selects a subgroup of G of order m, where m≤n (Step S61). If m is selected as a prime, it will have the preferred security performance. Please note that the subgroup can be selected as G itself, which also means m=n. As in an alternative embodiment, on the premise that after the group G is determined or selected, the selection of the subgroup can be omitted, which also means G itself is implicitly selected as the subgroup, since G is a subgroup of itself mathematically. That is also to say, when G itself is selected as the subgroup, which causes m=n, such a selection is seemingly dismissed. Of course, if the selection of the subgroup is omitted, the Subgroup Selector 52 (as described in Fig. 5) can also be omitted. - Then, the
Integer Selector 56 selects an integer as the private key x, such that x satisfies 1<|x|<m (Step S62). It is to be understood that one terminal may have a plurality of private keys, although the description herein is focused on how to generate a plurality of public keys from one private key, for the sake of simplicity. - Then, the
Generator Selector 53 selects and fixes a generator g of group G (Step S63). If G is a finite cyclic group, it always has at least one generator. It is to be noted that the selections of g and x is independent from each other. That is to say, although Step S62 is described prior to Step S63 here, the order of their performance can be reversed or they can be performed in parallel. - After the selection of G, m, x and g, an integer r is selected as the indicator that satisfies 0<|r|<m to generate a new public key under the control of the Control Unit 55 (Step S64).
- With the selection of G, m, x, g and r, a new public key is generated with the computation of y1=gr and then y2=y1 x (Step S65). Then the public key (y1,y2) can be released (Step S66) to the Receiver for encryption. Of course, there may be other information that is also released together with the public key.
- It is to be noted that the selection of g, x, and r has no sequential and dependency requirement between their selections, such that Steps S62, S63, S64 can be performed in any order, sequentially or concurrently. In addition, the selection of g, x and r may be at random or in accordance with some criteria as desired.
- Alternately, some of the aforementioned procedures may be omitted by the
Control Unit 55, but performed elsewhere. For example, the group G and the subgroup can be assigned by a third party such as an entrust organization. Hence theControl Unit 55 skips steps of selecting the group and subgroup, since they are now determined externally. Further, if one anonymous public key has been previously generated, it is for certain that the group, subgroup, generator and private key all have been selected and fixed. Therefore when a new public key is to be generated, theControl Unit 55 skips these four steps and goes directly to the following steps. - If y1 or y2 is originally outside the range of group G, they must be mapped into group G. The mapping methods may vary for different groups. However, the cyclic group G guarantees the existence of such mapping method.
- It is to be noted that the foregoing steps may be performed either in one single device/module (with integrated or discrete components) of a system, or in a distributed manner with respective devices of the system performing some of the steps, respectively.
- An example of the group, subgroup and generator selection is described below. Suppose group Zp* is selected where p=11, hence Z11*={1 , 2, 3, 4, 5, 6, 7, 8, 9, 10}. Since 11 is a prime, mathematically the order of Z11* is 11-1=10. The element 2 is a generator of Z11* as can be easily verified that Z11 *= {2i mod 11 / i=0,1,...,9}. Since a group is also a subgroup of itself, the subgroup may be chosen as Z11*. Another choice of subgroup for example is { 1, 3, 4, 5, 9} which has the generator 3 of order 5. Again it's easy to verify that 35=1 mod 11.
- Furthermore, as can be appreciated by those skilled in the art all of the devices and components can be implemented in hardware, software, firmware or the combination thereof depending upon various considerations.
- The exemplary method primarily described in Fig. 6 is only one of the numerous methods available for generating anonymous public keys according to the present invention. There are more advanced methods that not only can be used for the same purpose, but also can achieve optimization in performance. To describe the optimization methods, the encoding and decoding procedures well known in the art are briefly summarized with reference to Fig. 4, 5 and 7, wherein ⊙ is a group G invertible operation and ∅ is the exact inverse operation of ⊙. The present invention has been applied in the procedures in Fig.7.
- To encrypt a plain text M, M is first represented as an element of G (for example, M is represented as its ASCII code) (Step S80), then an integer k is selected as the designator satisfying 1<|k|<m (Step S81) and a pair of values are computed as follows (Step S82)
where C1, and C2 are group G members. All of these operations can be done by theEncoding Device 48 in Fig. 4. Examples of ⊙ can be multiplication, division, addition or subtraction of group G. If C1 or C2 is originally outside the range of group G, they must be mapped into group G. The mapping methods may vary for different groups. - At this time, the cipher text of the message M is obtained as C = (C1 C2) (Step S83) and it can be sent out over a communication channel by the Sending
Unit 44. - For a message M that is outside the range of group G to be encoded, it must be transformed into several group members before encoding. Following subsequent decoding, the recovered group members may be transformed back to the original message. The transformation methods may vary for different groups. One example is breaking the message into several blocks, each of which is a member of group G, and concatenating all the blocks to reconstruct M.
- At the other side of the communication channel, the cipher-text message C is received (Step S84). To retrieve the plain text M from the cipher text C, first it has to be decided between two ways, direct exponentiation or not (Step S85). If yes, rb=C1 x is first computed (Step S86) and then M is obtained by computing M=C2∅rb (Step S87); otherwise, ra=C1 -x is first computed (Step S88) and then M is obtained by computing M=C2⊙ra (Step S89).
- After successful decryption of a cipher text (C1, C2), depending on the implementation of decryption, the Public
Keys Generating Device 49, in accordance with the present invention, may make use of the received cipher text as well as the intermediate decryption output ra to generate a new anonymous public key in the form of (y1=C1 -1, y2=ra). Similarly, the PublicKeys Generating Device 49 may make use of the received cipher text as well as the intermediate decryption output rb to generate a new anonymous public key in the form of (y1=C1, y2=rb). In either way of generating a new anonymous public key, the exponentiation operation is avoided and computation efficiency is enhanced. - Furthermore, when a single anonymous public key (y1, y2) is provided, the Public
Keys Generating Device 49 may generate a new anonymous public key in the form of (y2, y2 x). This method can be utilized multiple times to generate a chain of public keys. This way, storage consumption of the public keys generated are heavily reduced since the second portion of the public key, y2, is identical to the first portion of its following. For a chain of w public keys, up to (w-1)/2w percentage of storage are saved which implies approximate 50% saving for w large enough. - In this invention, since the public keys are generated with the same generator based on the form of powers of the generator, the powers of the generator g can be reused to generate a series of public keys, which involves multiplication, instead of exponentiation, thus saving the memory storage and accelerating the computation. Meanwhile; since only one table of the powers of the generator needs to be maintained in the decoding device, the computation of new public keys can be performed off-line.
- For example, in an embodiment, when a cipher text message C=(C1 ,C2) is received in the decoding device, C1 can be retrieved and utilized to generate new public keys. As described, C1=y1 k= grk, and grk can be saved to generate new public keys because the product "rk" is only another integer. It is to be noted that although grk can be saved to generate new public keys, the value of rk may still be unknown to the decoding device, unless the encoding device revealed k when sending the encrypted message.
- When a single anonymous public key (y1, y2) is provided, the Public
Keys Generating Device 49 may generate a new anonymous public key in the form of (y1 × y1, y2 × y2), where × is group multiplication. In general, if there are provided several anonymous public keys (y11, y21), (y12 , y22),..., (y1j, y2j), j≥2, based on the plurality of stored powers of g, y11=gr1, y12=gr2,···, y1j=grj, and y21=y11 x, y22= y12 x,..., y2j=y1j x, a new public key can be computed as (y1(j+1)=y11y12···y1j, y2(j+1)= y21y22···y2j), where y11y12···y1j is the product of y11, y12,···, y1j, y21y22···y2j is the product of y21, y22,···, y2j. Clearly, to generate a new anonymous public key, the exponentiation operation is replaced by multiplication and computation efficiency is enhanced. Since multiplication can be carried out online, new public keys generated in this way may not need to be pre-computed, which directly implies saving of storage space. - The above optimization techniques may be jointly used to generate new anonymous public keys. For instance, upon receiving and after successful decryption of a series of cipher texts (C11, C21,), (C12, C22)...(C1j, C2j), j≥2, the Public
Keys Generating Device 49 can make use of the received cipher texts as well as the intermediate decryption outputs rb1, rb2, ..., rbj to generate a new anonymous public key in the form of (y1=(C11 C12···C1j), y2=(rb1rb2···rbj)), where C11C12···C1j is the product of C11, C12,···, C1j, rb1rb2···rbj is the product of rb1, rb2,..., rbj. - Furthermore, with the computation of y2, a series of public keys can be computed as (y2 w1, y2 w2), where w1=xw , w2=x(w+1) , w≥0. Furthermore, all of the results, specifically the powers of g, obtained in this computation can be utilized to generate further public keys.
- Furthermore, based on C1 retrieved from the cipher-text message C, the decoding device can generate more new public keys. For this purpose, C1 xand C1 -x can be computed and saved, and then two series of public keys can be generated. In general, when a plurality of encrypted messages CC1=(C11,C12), CC2=(C21,C22),···, CCj=(Cj1,Cj2) are received, for the case of C1 x, a series of new public keys can be generated as ((C11C21···Cj1)u1, (C11C21···Cj1)u2), where C11C21···Cj1 is the product of C11, C21,···, Cj1, j≥1, u1=xu, u2=x(u+1) and u≥0, and for the case of C1 -x, another series of new public keys can be generated as ((C11C21···Cj1)v1, (C11C21···Cj1)v2), where C11C21···Cj1 is the product of C11, C21,···, Cj1, j≥1, v1=-xv, v2=-x(v+1) and v≥0. Furthermore, all of the results, specifically the powers of g, obtained in this computation can be utilized to generate further public keys.
- In some cases, the user may wish to select several private keys and generate several series of anonymous public keys for different private keys, respectively. The user can select several private keys xi, and generate anonymous public keys for each xi as (ga, gaxi). Since the one-private-key-to-one-public-key model is displaced by the teaching of the present invention, the anonymity of anonymous public keys implies anonymity of said several private keys. In this sense, this invention also achieves anonymous private key.
- We now illustrate a secure communication system embodiment in accordance with this invention, where anonymous public keys technique is based on cyclic group Zp *. For the sake of simplicity, p=11, hence Z11 *={1, 2, 3, 4, 5, 6, 7, 8, 9, 10}. The order of Z11 * is 10. The subgroup is chosen as Z11 *. The generator is 2.
- At the decoding side, the private key is selected as x=3. If the integer a=4 is selected as the indicator, the Public
Keys Generating Device 49 generates an anonymous public key (24=5, 53=4) mod 11. For another integer a=7, the PublicKeys Generating Device 49 generates another anonymous public key (27=7, 73=2) mod 11. - Suppose these two anonymous public keys are delivered to two receivers. Receiver A that receives public key (5, 4) has plain text 8 to encrypt. Another receiver, Receiver B has plaintext 10 to encrypt.
- Receiver A selects integer 6 as the designator and computes the cipher text of 8 as (56=5, 8 × 46=10) mod 11. Similarly, Receiver B selects integer 3 and compute the cipher text of 10 as (73=2, 10 × 23=3) mod 11.
- The cipher text (5, 10) and (2, 3) are passed to the decoding side, respectively. The plaintext of (5, 10) may be computed according to 5-3=510× 5-3=57=3 mod 11 and 10×3=8 mod 11. The plain text of (4, 7) may be computed according to 23=8 mod 11, and 3/8=3 × 81=3×810×-1=3×89=10 mod 11.
- Thus, plaintext 8 and 10 are successfully retrieved at the decoding side. Further, optimization techniques can be utilized to generate new anonymous public keys.
- Based on the cipher text (2, 3) and intermediate decoding output 8, an anonymous public key may be generated as (2, 8).
- Based on the cipher text (5, 10) and intermediate decoding output 3, an anonymous public key may be generated as (5-1=9, 3) mod 11.
- Based on one of the anonymous public keys (2, 8), a series of public keys may be generated as (2, 8), (8, 83=6), (6, 63=7) mod 11.
- Based on one of the anonymous public keys (9, 3), a new public key may be generated as (9X9= 4, 3X3=9) mod 11.
- Based on some of the anonymous public keys, such as (2, 8), (7, 2), a new public key may be generated as (2 × 7=3, 8 × 2=5) mod 11.
- As can be seen from the above description, parameters from various senders are utilized to generate new public keys. Therefore, the privacy level of the resultant public keys can be improved. It is to be noted that all of the public keys are generated based on one single private key x and the same generator g.
- Aspects of the invention can be implemented in computer executable instructions contained in computer readable medium, and it can also be implemented in hard-wired logic/circuitry or combination of hardware and software. Furthermore, the devices involved in the specification may also include memory, such as RAM, DRAM and ROM, to store necessary data and computer executable instructions to perform the steps taught in this invention. And such memory can also be incorporated in the encoding device and/or the decoding device of the terminal. Such use of the memory is well known in the art, so it is not described here or illustrated in the accompanying drawings.
- The invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The present embodiments are therefore to be considered in all respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of equivalency of the claims are therefore intended to be embraced therein.
Claims (22)
- A method of generating public keys for encrypting messages to be transmitted, comprising:selecting a private key;generating a public key using said private key and an generator, said private key and said generator being from a predetermined group; andreleasing said public key before or at the beginning of a communication session, wherein multiple public keys are generated using said private key and said generator for multiple communication sessions.
- The method of claim 1, wherein said step of generating further comprises:selecting said group G of a predetermined order;selecting the private key based on said order;selecting a member g of group G as the generator;selecting an integer r as an indicator within said order; andcomputing said public key based on said private key, said generator and said indicator.
- The method of claim 1 or 2, wherein said step of generating further comprises:selecting a subgroup of said group G of equal or less order,and wherein the private key and the indicator is within the order of the subgroup.
- The method of claim 3, wherein
the order of the group G is an positive integer n;
the order of the subgroup of G is m where m≤n;
the private key x satisfies 1<|x|<m;
the generator g is an element of G;
the indicator r satisfies 0<|r|<m;
said computing said public key comprises computing y1=gr and y2=y1 x; and
when a new indicator is selected, a new public key is generated. - The method of claim 4, further comprising:computing a series of public keys based on y2.
- The method of claim 2, 3, 4 or 5, further comprising:storing powers of said generator g; andcomputing new public keys based on said stored powers of said generator g.
- The method of claim 6, further comprising:using said stored powers of said generator to compute a new public key as the product of said stored powers.
- A computing device for generating a plurality of public keys, comprising:a group selector for selecting a group of a predetermined order;a register for storing information generated or selected;an integer selector for selecting a private key x and an integer r as an indicator based on said order;a generator selector for selecting a generator g from said group;a group operator for performing group operation of said group;a generating module for generating the plurality of public keys from said private key with said generator; anda control unit for controlling operations of said group selector, said register, said integer selector, said group operator and said generating module.
- The device of claim 8, further comprising:a subgroup selector for selecting a subgroup of said group G whose order is m and m equals to or is less than the order of said group,wherein the private key x and the indicator r satisfy 1<|x|<m and 0<|r|<m respectively,and wherein said generating module compute a public key (y1, y2) by computing y1=gr and y2=y1 x and when a new indicator is selected, a new public key is generated.
- The device of claim 9, wherein the register further stores powers of the generator, which are used in generating new public keys by said generating module.
- The device of claim 10, wherein, based on a plurality of stored powers, a new public key is computed as the product of the stored powers.
- The device of claim 8,9,10 or 11,wherein any of said control unit, group selector, register,integer selector, group operator and generating module is implemented in software, hardware or the combination of software and hardware:
- A communication method, comprising:selecting a private key;generating a public key using said private key and an generator, said private key and said generator being from a predetermined group;releasing the public key;encrypting a message M with the public key to obtain an encrypted message C;sending the encrypted message C over a communication channel;receiving the encrypted message C on the communication channel; anddecrypting the encrypted message C with the private key to recover the message M, whereinmultiple different public keys are generated using said private key and said generator for multiple different communication sessions.
- The method of claim 13, further comprising:selecting a subgroup of said group G of equal or less order,wherein the public keys are generated based on the subgroup.
- The method of claim 14, wherein
the order of the group G is an positive integer n;
the order of the subgroup of G is an positive integer m where m≤n;
the private key x satisfies 1<|x|<m;
the generator g is an element of G;
an indicator r is selected as satisfies 0<|r|<m; and
said public key is computed as (y1, y2) where y1=gr and y2=y1 x, wherein when a different indicator is selected, a different public key is generated. - The method of claim 15, wherein the encrypted message is computed from the message M by:
selecting an integer k as an designator satisfying 1<|k|<m; and
computing the encrypted message C by computing C= (C1, C2) where C1 = y1 k and C2 = M⊙y2 k, and wherein when the encrypted message is received, C1 is retrieved from the message and utilized to generate new public keys. - The method of claim 13,14,15 or 16, wherein when a plurality of enaypted messages are received, a series of new public keys are generated based on the product of portions of the received encrypted messages.
- A communication system comprising:one or more encoding devices;a decoding device has a private key; andone or more communication channels over which the encoding devices communicate with the decoding device,wherein when a new communication session is started over one of the channels, the decoding device generates a new public key from the private key with the same generator of a group.
- The system of claim 18, wherein the decoding device stores powers of said generator which are used in computing new public keys.
- The system of claim 19, wherein when the encrypted message is received in the decoding device, it is utilized to generate new public keys.
- A manufacturing article having a machine readable medium with instructions recorded thereon which, when executed by one or more processors, causes the processors to
select a private key;
generate a public key using said private key and an generator, said private key and said generator being from a predetermined group; and
release said public key before or at the beginning of said communication session, wherein
multiple public keys are generated using said private key and said generator for multiple communication sessions. - A manufacturing article having a machine readable medium with instructions recorded thereon which, when executed by a processor, cause the processor to
select a private key;
generate a public key using said private key and an generator, said private key and said generator being from a predetermined group;
release the public key;
encrypt a message with the public key;
send the encrypted message over a communication channel;
receive the encrypted message on the communication channel; and
decode the encrypted message with the private key to recover the message, wherein
multiple different public keys are generated using said private key and said generator for multiple different communication sessions.
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN200410090903XA CN1773905B (en) | 2004-11-10 | 2004-11-10 | Method, equipment and system for generating anonymous common key in safety communication system |
Publications (1)
Publication Number | Publication Date |
---|---|
EP1657847A1 true EP1657847A1 (en) | 2006-05-17 |
Family
ID=35478350
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP20050023986 Withdrawn EP1657847A1 (en) | 2004-11-10 | 2005-11-03 | Method, device and system for generating anonymous public keys |
Country Status (6)
Country | Link |
---|---|
US (1) | US7873169B2 (en) |
EP (1) | EP1657847A1 (en) |
JP (1) | JP2006141032A (en) |
KR (1) | KR100857323B1 (en) |
CN (1) | CN1773905B (en) |
CA (1) | CA2525796C (en) |
Cited By (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101179374B (en) * | 2006-11-09 | 2011-11-09 | 日电(中国)有限公司 | Communication equipment, communications system and method therefor |
EP2348445A3 (en) * | 2009-12-18 | 2011-12-21 | CompuGroup Medical AG | A computer readable storage medium for generating a pseudonym, computer implemented method and computing device |
EP2348443A3 (en) * | 2009-12-18 | 2011-12-21 | CompuGroup Medical AG | A computer readable storage medium for generating an access key, computer implemented method and computing device |
EP2348447A3 (en) * | 2009-12-18 | 2012-11-07 | CompuGroup Medical AG | A computer implemented method for generating a set of identifiers from a private key, computer implemented method and computing device |
EP2365456A3 (en) * | 2010-03-11 | 2013-05-22 | CompuGroup Medical AG | Data structure, method and system for predicting medical conditions |
EP2336933A3 (en) * | 2009-12-18 | 2013-06-12 | CompuGroup Medical AG | A computer implemented method for analyzing data of a user with the data being stored pseudonymously in a database |
US8516267B2 (en) | 2009-12-18 | 2013-08-20 | Adrian Spalka | Computer readable storage medium for generating an access key, computer implemented method and computing device |
US8661247B2 (en) | 2009-12-18 | 2014-02-25 | CompuGroup Medical AG | Computer implemented method for performing cloud computing on data being stored pseudonymously in a database |
US8677146B2 (en) | 2009-12-18 | 2014-03-18 | CompuGroup Medical AG | Computer implemented method for sending a message to a recipient user, receiving a message by a recipient user, a computer readable storage medium and a computer system |
US8719587B2 (en) | 2009-12-18 | 2014-05-06 | CompuGroup Medical AG | Computer implemented method for generating a pseudonym, computer readable storage medium and computer system |
Families Citing this family (23)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8058973B2 (en) | 2005-09-13 | 2011-11-15 | Nec (China) Co., Ltd. | Radio frequency identification system and method |
CN1937496A (en) * | 2005-09-21 | 2007-03-28 | 日电(中国)有限公司 | Extensible false name certificate system and method |
CN1956459A (en) * | 2005-10-27 | 2007-05-02 | 日电(中国)有限公司 | Virtual user identifier system and method |
US20070217612A1 (en) * | 2006-03-17 | 2007-09-20 | Vincent So | Method and system of key-coding a video |
JP5154830B2 (en) * | 2006-04-27 | 2013-02-27 | パナソニック株式会社 | Content distribution system |
CN101170404B (en) * | 2006-10-24 | 2010-05-19 | 华为技术有限公司 | Method for secret key configuration based on specified group |
CN101272240B (en) * | 2007-03-21 | 2013-01-23 | 华为技术有限公司 | Conversation cryptographic key generation method, system and communication equipment |
CN101682508A (en) | 2007-06-11 | 2010-03-24 | Nxp股份有限公司 | Method of generating a public key for an electronic device and electronic device |
JP5060556B2 (en) * | 2007-07-11 | 2012-10-31 | 株式会社東芝 | Group signature system, apparatus and program |
US20100150343A1 (en) * | 2008-12-15 | 2010-06-17 | Nxp B.V. | System and method for encrypting data based on cyclic groups |
CA3037741C (en) | 2009-07-20 | 2021-10-19 | Bce Inc. | Improved signal security in a satellite signal distribution environment |
CA2688956C (en) * | 2009-07-20 | 2017-10-03 | Bce Inc. | Automatic user band assignment in a satellite signal distribution environment |
CA2785047C (en) | 2009-12-21 | 2017-12-19 | Bce Inc | Methods and systems for re-securing a compromised channel in a satellite signal distribution environment |
US8553878B2 (en) * | 2010-04-14 | 2013-10-08 | Apple Inc. | Data transformation system using cyclic groups |
US8842833B2 (en) | 2010-07-09 | 2014-09-23 | Tata Consultancy Services Limited | System and method for secure transaction of data between wireless communication device and server |
WO2013134306A1 (en) | 2012-03-05 | 2013-09-12 | Michael Fiske | One-time passcodes with asymmetric keys |
WO2016187432A1 (en) * | 2015-05-19 | 2016-11-24 | Michael Fiske | Hiding a public key exchange in noise |
US10776502B2 (en) | 2016-06-12 | 2020-09-15 | Apple Inc. | Diversification of public keys |
US10853510B2 (en) | 2016-06-12 | 2020-12-01 | Apple Inc. | Association of address with cloud services account |
WO2018216749A1 (en) * | 2017-05-25 | 2018-11-29 | Necネットワーク・センサ株式会社 | Cryptographic communication method, information processing device, and program |
CN107682375A (en) * | 2017-11-21 | 2018-02-09 | 武汉珈港科技有限公司 | A kind of key management and dynamic key guard method |
US11201741B2 (en) | 2020-03-03 | 2021-12-14 | The Prudential Insurance Company Of America | System for improving data security |
CN114363858A (en) * | 2022-03-21 | 2022-04-15 | 苏州浪潮智能科技有限公司 | Conversation and registration method, system and related components of cellular internet of vehicles cooperative communication |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US4405829A (en) * | 1977-12-14 | 1983-09-20 | Massachusetts Institute Of Technology | Cryptographic communications system and method |
US5901229A (en) * | 1995-11-06 | 1999-05-04 | Nippon Telegraph And Telephone Corp. | Electronic cash implementing method using a trustee |
KR20000071078A (en) * | 1997-02-14 | 2000-11-25 | 헬렌 브이. 단요 | Cyclotomic polynomial construction of discrete logarithm cryptosystems over finite fields |
US7434046B1 (en) * | 1999-09-10 | 2008-10-07 | Cisco Technology, Inc. | Method and apparatus providing secure multicast group communication |
CN1258051A (en) * | 1999-12-23 | 2000-06-28 | 赵风光 | Encryption system and device for public key |
-
2004
- 2004-11-10 CN CN200410090903XA patent/CN1773905B/en not_active Expired - Fee Related
-
2005
- 2005-11-03 EP EP20050023986 patent/EP1657847A1/en not_active Withdrawn
- 2005-11-07 CA CA2525796A patent/CA2525796C/en not_active Expired - Fee Related
- 2005-11-09 US US11/269,774 patent/US7873169B2/en not_active Expired - Fee Related
- 2005-11-09 KR KR1020050106938A patent/KR100857323B1/en not_active IP Right Cessation
- 2005-11-10 JP JP2005326575A patent/JP2006141032A/en not_active Withdrawn
Non-Patent Citations (2)
Title |
---|
CHEN L: "ACCESS WITH PSEUDONYMS", CRYPTOGRAPHY: POLICY AND ALGORITHMS. INTERNATIONAL CONFERENCE, 3 July 1995 (1995-07-03), pages 232 - 243, XP001097325 * |
WATERS BR, FELTEN E W, SAHAI A: "Receiver anonymity via incomparable public keys", 10TH ACM CONFERENCE ON COMPUTER AND COMMUNICATIONS SECURITY, ASSOCIATION FOR COMPUTER MACHINERY, 30 October 2003 (2003-10-30), Washington D.C., USA, pages 112 - 121, XP002361168, ISBN: 1-58113-738-9, Retrieved from the Internet <URL:http://portal.acm.org/citation.cfm?id=948127> [retrieved on 20051229] * |
Cited By (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101179374B (en) * | 2006-11-09 | 2011-11-09 | 日电(中国)有限公司 | Communication equipment, communications system and method therefor |
US8516267B2 (en) | 2009-12-18 | 2013-08-20 | Adrian Spalka | Computer readable storage medium for generating an access key, computer implemented method and computing device |
EP2348443A3 (en) * | 2009-12-18 | 2011-12-21 | CompuGroup Medical AG | A computer readable storage medium for generating an access key, computer implemented method and computing device |
EP2348447A3 (en) * | 2009-12-18 | 2012-11-07 | CompuGroup Medical AG | A computer implemented method for generating a set of identifiers from a private key, computer implemented method and computing device |
EP2336933A3 (en) * | 2009-12-18 | 2013-06-12 | CompuGroup Medical AG | A computer implemented method for analyzing data of a user with the data being stored pseudonymously in a database |
EP2348445A3 (en) * | 2009-12-18 | 2011-12-21 | CompuGroup Medical AG | A computer readable storage medium for generating a pseudonym, computer implemented method and computing device |
US8661247B2 (en) | 2009-12-18 | 2014-02-25 | CompuGroup Medical AG | Computer implemented method for performing cloud computing on data being stored pseudonymously in a database |
US8677146B2 (en) | 2009-12-18 | 2014-03-18 | CompuGroup Medical AG | Computer implemented method for sending a message to a recipient user, receiving a message by a recipient user, a computer readable storage medium and a computer system |
US8695106B2 (en) | 2009-12-18 | 2014-04-08 | CompuGroup Medical AG | Computer implemented method for analyzing data of a user with the data being stored pseudonymously in a database |
US8699705B2 (en) | 2009-12-18 | 2014-04-15 | CompuGroup Medical AG | Computer implemented method for generating a set of identifiers from a private key, computer implemented method and computing device |
US8719587B2 (en) | 2009-12-18 | 2014-05-06 | CompuGroup Medical AG | Computer implemented method for generating a pseudonym, computer readable storage medium and computer system |
US8887254B2 (en) | 2009-12-18 | 2014-11-11 | CompuGroup Medical AG | Database system, computer system, and computer-readable storage medium for decrypting a data record |
EP2365456A3 (en) * | 2010-03-11 | 2013-05-22 | CompuGroup Medical AG | Data structure, method and system for predicting medical conditions |
US8868436B2 (en) | 2010-03-11 | 2014-10-21 | CompuGroup Medical AG | Data structure, method, and system for predicting medical conditions |
Also Published As
Publication number | Publication date |
---|---|
CA2525796A1 (en) | 2006-05-10 |
US20060098819A1 (en) | 2006-05-11 |
KR100857323B1 (en) | 2008-09-05 |
CN1773905B (en) | 2010-08-18 |
US7873169B2 (en) | 2011-01-18 |
CA2525796C (en) | 2011-02-15 |
JP2006141032A (en) | 2006-06-01 |
CN1773905A (en) | 2006-05-17 |
KR20060052556A (en) | 2006-05-19 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7873169B2 (en) | Methods, devices and systems for generating anonymous public keys in a secure communication system | |
CA2054037C (en) | Cryptographic system allowing encrypted communication between users with a secure mutual cipher key determined without user interaction | |
Dodis et al. | Key-insulated public key cryptosystems | |
Almaiah et al. | A new hybrid text encryption approach over mobile ad hoc network | |
US9049023B2 (en) | Outsourcing the decryption of functional encryption ciphertexts | |
CN104270249B (en) | It is a kind of from the label decryption method without certificate environment to identity-based environment | |
US20120121080A1 (en) | Commutative order-preserving encryption | |
JP5544355B2 (en) | Method and system for verifying shared secrets | |
CN104301108B (en) | It is a kind of from identity-based environment to the label decryption method without certificate environment | |
Reyad | Text message encoding based on elliptic curve cryptography and a mapping methodology | |
CN110011995A (en) | Encryption and decryption approaches and device in multi-casting communication | |
Natanael et al. | Text encryption in android chat applications using elliptical curve cryptography (ECC) | |
CN113014386A (en) | Cipher system based on multi-party cooperative computing | |
US20100150343A1 (en) | System and method for encrypting data based on cyclic groups | |
CN116743358A (en) | Repudiation multi-receiver authentication method and system | |
CN109981254A (en) | A kind of miniature public key encryption method based on limited Lee's type group's resolution problem | |
Mahmoud | Development of Matrix Cipher Modifications and Key Exchange Protocol | |
Basu et al. | Secured hierarchical secret sharing using ECC based signcryption | |
Kester | A public-key exchange cryptographic technique using matrix | |
Odlyzko | Public key cryptography | |
Dong et al. | A restrained paillier cryptosystem and its applications for access control of common secret | |
CN116781243B (en) | Unintentional transmission method based on homomorphic encryption, medium and electronic equipment | |
Bodkhe et al. | Hybrid encryption algorithm based improved RSA and Diffie-Hellman | |
CN113872757B (en) | Broadcast encryption method based on SM2 public key encryption algorithm | |
JP3622072B2 (en) | Encryption communication method |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR |
|
AX | Request for extension of the european patent |
Extension state: AL BA HR MK YU |
|
17P | Request for examination filed |
Effective date: 20060420 |
|
AKX | Designation fees paid |
Designated state(s): BE CH DE GB LI |
|
17Q | First examination report despatched |
Effective date: 20150428 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN |
|
18D | Application deemed to be withdrawn |
Effective date: 20150909 |